Introduce --allow command-line argument to allow traffic to CIDRs (#34)

lib/proxy/mod.rs

@@ -8,7 +8,9 @@ use crate::host::NetType;
 use crate::poller::Poller;
 use crate::vm::VM;
 use anyhow::Result;
+use ipnet::Ipv4Net;
 use mac_address::MacAddress;
+use prefix_trie::PrefixSet;
 use smoltcp::wire::EthernetFrame;
 use std::io::ErrorKind;
 use std::os::unix::io::{AsRawFd, RawFd};
@@ -19,11 +21,17 @@ pub struct Proxy {
     poller: Poller,
     vm_mac_address: smoltcp::wire::EthernetAddress,
     dhcp_snooper: DhcpSnooper,
+    allow: PrefixSet<Ipv4Net>,
     enobufs_encountered: bool,
 }
 
 impl Proxy {
-    pub fn new(vm_fd: RawFd, vm_mac_address: MacAddress, vm_net_type: NetType) -> Result<Proxy> {
+    pub fn new(
+        vm_fd: RawFd,
+        vm_mac_address: MacAddress,
+        vm_net_type: NetType,
+        allow: PrefixSet<Ipv4Net>,
+    ) -> Result<Proxy> {
         let vm = VM::new(vm_fd)?;
         let host = Host::new(vm_net_type)?;
         let poller = Poller::new(vm.as_raw_fd(), host.as_raw_fd())?;
@@ -34,6 +42,7 @@ impl Proxy {
             poller,
             vm_mac_address: smoltcp::wire::EthernetAddress(vm_mac_address.bytes()),
             dhcp_snooper: Default::default(),
+            allow,
             enobufs_encountered: false,
         })
     }

lib/proxy/vm.rs

@@ -2,6 +2,7 @@ use crate::proxy::udp_packet_helper::UdpPacketHelper;
 use crate::proxy::Proxy;
 use anyhow::Context;
 use anyhow::Result;
+use ipnet::Ipv4Net;
 use smoltcp::wire::{
     ArpPacket, EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Packet, UdpPacket,
 };
@@ -58,15 +59,22 @@ impl Proxy {
     }
 
     fn allowed_from_vm_ipv4(&self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
-        // Once we've learned the VM's IP from the DHCP snooping,
-        // allow all global traffic for that VM's IP
+        // Have we learned the VM's IP from the DHCP snooping?
         if let Some(lease) = &self.dhcp_snooper.lease() {
-            let dst_is_global =
-                ip_network::IpNetwork::from(Ipv4Addr::from(ipv4_pkt.dst_addr().0)).is_global();
+            // If so, allow all global traffic
+            let dst_addr = Ipv4Addr::from(ipv4_pkt.dst_addr().0);
+            let dst_is_global = ip_network::IpNetwork::from(dst_addr).is_global();
 
             if lease.valid_ip_source(ipv4_pkt.src_addr()) && dst_is_global {
                 return Some(());
             }
+
+            // Also allow all traffic to the user-specified CIDRs
+            let dst_net = Ipv4Net::from(dst_addr);
+
+            if self.allow.get_spm(&dst_net).is_some() {
+                return Some(());
+            }
         }
 
         // Allow communication with host